Authorization Bypass in Devolutions Server Affects Sensitive Data Access
CVE-2026-100286

Currently unrated

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
29 September 2026

What is CVE-2026-100286?

A security vulnerability exists in Devolutions Server versions up to 2026.3.5.0, where missing authorization checks in the data source settings API can permit authenticated non-administrative users to exploit this flaw. By crafting specific API requests, attackers may disclose sensitive integration secrets, posing a risk to data confidentiality. Organizations using afflicted versions should prioritize applying updates to safeguard against potential exploitation.

Affected Version(s)

Server 0 < 2026.3.7.0

References

https://devolutions.net/security/advisories/DEVO-2026-0034/

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.